JWT Issuer Configuration#
oauth2-proxy supports validating JWT bearer tokens from multiple issuers via --skip-jwt-bearer-tokens and --extra-jwt-issuers. When --skip-jwt-bearer-tokens is enabled, requests bearing a verified JWT are passed through without redirecting to the OAuth flow. Extra issuers beyond the primary provider are registered at startup using --extra-jwt-issuers (cfg: extra_jwt_issuers, env: OAUTH2_PROXY_EXTRA_JWT_ISSUERS) .
Configuration Format#
Each entry in --extra-jwt-issuers is a string of the form issuer_url=audience :
--extra-jwt-issuers=https://accounts.google.com=my-client-id
parseJwtIssuers splits on =, treating everything after the first = as the audience (allowing = in the audience value) . This produces a jwtIssuer struct with issuerURI and audience fields .
How Verifiers Are Constructed (newVerifierFromJwtIssuer)#
newVerifierFromJwtIssuer builds a ProviderVerifier for each parsed issuer using a minimal ProviderVerifierOptions — only four fields are set :
| Field | Value |
|---|---|
AudienceClaims | Inherited from Providers[0].OIDCConfig.AudienceClaims |
ClientID | The audience portion of the issuer=audience string |
ExtraAudiences | Inherited from Providers[0].OIDCConfig.ExtraAudiences |
IssuerURL | The issuer_url portion of the issuer=audience string |
Notable omissions: SupportedSigningAlgs, SkipIssuerVerification, PublicKeyFiles, and JWKsURL are never set by newVerifierFromJwtIssuer. The SupportedSigningAlgs field on ProviderVerifierOptions exists and is threaded through to oidc.Config — but because it is not populated here, any --oidc-enabled-signing-algs restriction configured for the primary provider is silently ignored for extra issuers.
Discovery with automatic fallback: The function first attempts OIDC discovery via NewProviderVerifier . If that fails, it retries with SkipDiscovery=true and a hard-coded fallback JWKS URL of <issuerURI>/.well-known/jwks.json . There is no way to supply a custom JWKS URL for an extra issuer.
Limitations#
-
No signing algorithm restrictions.
SupportedSigningAlgsis never set for extra issuers. TheintersectSigningAlgsintersection logic that enforces--oidc-enabled-signing-algsagainst the primary provider's discovery document is bypassed entirely. -
Hard-coded JWKS fallback path. The fallback JWKS URL is always
<issuerURI>/.well-known/jwks.json. Issuers that host JWKS at a different path require a working OIDC discovery endpoint. -
No custom CA / TLS options.
ProviderVerifierOptionsfor extra issuers shares the global HTTP transport; there is no per-issuer CA or TLS override. -
No
SkipIssuerVerification. By default the ID tokenissclaim must exactly match the configuredIssuerURL; the--insecure-oidc-skip-issuer-verificationflag only applies to the primary provider. -
Audience from first provider's config only.
AudienceClaimsandExtraAudiencesare always taken fromProviders[0], not configurable per-issuer.
Key Source Files#
| File | Purpose |
|---|---|
pkg/validation/options.go | Top-level wiring: calls parseJwtIssuers and newVerifierFromJwtIssuer, registers verifiers |
pkg/validation/options.go L128-167 | parseJwtIssuers and newVerifierFromJwtIssuer implementations |
pkg/providers/oidc/provider_verifier.go | ProviderVerifierOptions struct — all fields available (most unused for extra issuers) |
pkg/providers/oidc/provider_verifier.go L103-168 | NewProviderVerifier and getVerifierBuilder — discovery path and signing alg intersection |
pkg/apis/options/options.go L59-61 | SkipJwtBearerTokens and ExtraJwtIssuers flag definitions |